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Contracting  Guide  for  FOIP  and  Records  Management 


1.  INTRODUCTION 
Overview 

Contracting,  outsourcing,  joint  service 
delivery,  privatization  and  other  service 
delivery  arrangements  are  being  used 
extensively  by  public  bodies  in  the 
Government  of  Alberta  to  meet 
operational  demands.  This  has  an 
important  impact  on  the  administration 
of  the  Freedom  of  Information  and 
Protection  of  Privacy  (FOIP)  Act  and 
the  application  of  records  management 
requirements  under  the  authority  of  the 
Records  Management  Regulation 
(RMR). 

Policy 

Public  bodies  must  take  freedom  of 
information,  protection  of  privacy  and 
records  management  considerations  into 
account  when  negotiating  contracts  and 
agreements. 

All  agreements  and  joint  service 
contracts  should  identify  the  generic 
types  of  records  or  personal  information 
over  which  a public  body  wishes  to 
maintain  custody  or  control  and  set  out 
obligations  or  responsibilities  of  the 
contractor  or  other  party  in  regard  to 
freedom  of  information,  protection  of 
privacy  and  records  management. 

Purpose 

These  guidelines  are  intended  to  assist 
Freedom  of  Information  and  Privacy 
(FOIP)  Coordinators  and  Senior 
Records  Officers  (SROs)  within  public 
bodies  to: 

a)  deal  with  freedom  of  information, 
protection  of  privacy  and  records 
management  issues  arising  from 


contracting,  including  outsourcing, 
joint  service  delivery  and 
privatization;  and 

b)  provide  guidance  for  dealing  with 
records  relating  to  the  contracting 
process  that  may  be  the  subject  of 
either  FOIP  requests  or  informal 
access  requests  from  the  public. 

This  document  assumes  that  the  reader 
is  very  familiar  with  the  FOIP  Act  and 
the  RMR.  A Contract Manager*s 
Guide  to  Freedom  of  InformatioHy 
Protection  of  Privacy  and  Records 
Management  is  also  available  for  those 
responsible  for  developing  tenders  for 
requests  for  proposals  and  contracts.  In 
addition  a brochure  for  contractors  is 
available. 

Note:  This  document  is  intended  to 
provide  guidance  on  the  issues  that 
must  be  considered  when  contracting 
private  sector  resources.  Contract 
clauses  noted  in  this  guide  are  examples 
only  and  are  not  appropriate  for  every 
circumstance.  Legal  advice  on  your 
particular  tendering  documents  and 
contracts  is  strongly  advised. 

Definitions 

For  the  purposes  of  this  guide: 

• contracting  is  considered  to  be  the 
process  by  which  a public  body 
enters  into  a contract  enforceable  at 
law  where  a legal  obligation  is 
constituted  and  defined  between  the 
government  and  another  party  or 
parties.  Contracts  to  outsource  a 
particular  operation  or  service,  joint 
service  delivery  arrangements  and 
privatization  are  all  types  of  such 
contracts  which  require  special 
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considerations  from  freedom  of 
information  and  records 
management  perspectives. 

outsourcing  is  the  process  by  which 
a public  body  enters  into  an 
agreement  with  another  party 
(usually  the  private  sector  but 
sometimes  another  publie  sector  or 
non-profit  organization)  to  deliver 
services  or  carry  out  operations  on 
its  behalf  In  such  instances,  the 
public  body  retains  the  statutory  or 
legal  responsibility  for  the  delivery 
of  the  service  or  the  carrying  out  of 
the  operation  and  will  fund  the  other 
organization  to  carry  out  the 
government’s  responsibilities. 

joint  service  delivery  involves  an 
agreement  among  public  bodies, 
different  levels  of  government  or 
with  non-profit  organizations  to  join 
together  in  the  delivery  of  programs 
and  services  which  are  related  to 
one  another  but  have  been  operated 
separately  in  the  past. 

privatization  is  the  process  by  which 
a public  body  ceases  to  provide  a 
service  or  carry  out  an  operation  and 
facilitates  the  transfer  of  such 
services  or  operations  to  the  private 
or  non-profit  sector  when  the 
government  does  not  have  a legal 
obligation  to  perform  the  service  or 
function. 

public  body  is  defined  in  section 
1(1  )(p)  of  the  FOIP  Act.  It  includes 
in  part  a department,  branch  or 
office  of  the  Government  of  Alberta 
as  well  as  any  agency  that  is  listed 
in  the  FOIP  Regulation  and  offices 
of  Officers  of  the  Legislature. 


Custody  and  Control 

In  contracting,  joint  service  delivery  and 
privatization  the  legal  requirements  and 
obligations  in  regard  to  freedom  of 
information,  protection  of  privacy  and 
records  management  are  based  on  the 
concepts  of  custody  and  control.  These 
concepts  are  legally  established  by  the 
FOIP  Act  and  the  RMR. 

Control 

A record  is  under  the  control  of  a public 
body  for  purposes  of  both  the  FOIP 
legislation  and  records  management 
requirements  when  it  has  the  authority 
to  manage  the  record  including 
restricting,  regulating  and  administering 
its  use,  disclosure  and  disposition.  In  its 
broadest  sense,  the  concept  implies  an 
ownership  value  in  the  records.  Some 
indicators  that  a record  may  be  under 
the  control  of  a public  body  are  as 
follows: 

• the  record  was  created  by  an  officer, 
employee  or  member  of  the  public 
body  concerned; 

• the  record  was  created  by  an  outside 
consultant  for  the  public  body; 

• the  record  is  specified  in  a contract 
as  being  under  the  control  of  a 
public  body; 

• the  record  is  in  the  possession  of  the 
public  body; 

• the  record  is  closely  integrated  with 
other  records  of  the  public  body; 

• the  content  of  the  record  relates  to 
the  public  body's  mandate  and 
functions; 

• the  public  body  has  the  authority  to 
regulate  the  record's  use  and 
disposition;  the  public  body  has 
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relied  upon  the  record  to  a 
substantial  extent  in  its  operations; 
or 

• a contract  permits  the  public  body  to 
inspect,  review  or  copy  records 
produced,  received  or  acquired  by  a 
contractor  as  a result  of  a contract. 

Custody 

Custody  broadens  the  scope  of  control 
but  does  not  greatly  enlarge  the  range  of 
records  covered  by  the  FOIP  Act. 
Physical  possession  of  a record  by  a 
public  body  normally  constitutes 
custody.  However,  custody  also 
includes  the  guardianship  of  records.  It 
may  be  important  for  a public  body  to 
ensure  continuity  of  custody  over  a 
record  to  meet  legal  requirements  or  to 
stipulate  clearly  in  a contract  that  this 
custody  is  being  transferred  or  alienated 
to  another  party. 

Impact  on  Agreements  and 
Contracts 

The  first  fundamental  question  to  be 
asked  regarding  freedom  of 
information,  protection  of  privacy  and 
records  management  issues  in 
contracting,  joint  service  delivery  or 
privatization  arrangements  is  the  extent 
to  which  a public  body  wishes,  or  is 
legally  obligated,  to  maintain  custody  or 
control  over  records  involved  with  the 
arrangement.  This  governs: 

• the  nature  of  the  conditions  for 
freedom  of  information,  protection 
of  privacy  and  records  management 
requirements  set  out  in  pre- 
contractual  documentation  (e.g., 
requests  for  proposals  (RFPs)  or 
tenders); 


• the  actual  terms  and  conditions 
which  will  be  included  in  a contract 
or  other  agreement; 

• the  application  of  the  FOIP  Act  3. 
request  for  access  to  records  is 
made;  and 

• where  personal  information  is 
involved,  the  nature  of  the 
obligations  to  ensure  the  application 
of  Part  2 of  the  FOIP  legislation 
relating  to  the  protection  of  personal 
privacy. 

Decisions  about  the  extent  of  custody  or 
control  that  will  be  exercised  over 
particular  records  should  be  based  on: 

• the  nature  and  objectives  of  the 
programs  and  activities  being 
carried  out  under  contract  or 
agreement  and  the  management 
approach  underpinning  the  decision 
to  contract  or  enter  some  other  type 
of  agreement  (e.g.,  the  simple 
contracting  for  goods  or  services, 
the  desire  to  outsource  services  but 
maintain  strict  accountability  for  a 
service  or  the  desire  to  remove  the 
public  body  from  the  operation  or 
service  altogether); 

• any  specific  needs  to  meet  privacy 
protection  requirements; 

• the  need  to  provide  accountability  in 
the  transaction  of  public  business; 
and 

• the  balancing  of  custody,  control 
and  accountability  issues  with  the 
overall  costs  to  both  the  government 
and  contractor. 

For  example,  a public  body  might  wish 
to  have  unrestricted  access  to  a 
contractor's  records  for  the  purpose  of 
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program  auditing  and  evaluating 
performance.  If  this  is  an  important 
business  or  program  objective  then  it 
should  be  stipulated  in  the  contract  or 
agreement  governing  the  activity  and  an 
obligation  should  be  placed  on  the 
contractor  to  create  and  maintain 
records  which  meet  these  purposes.  A 
corollary  to  this  extension  of  the  public 
body's  control  over  information  creation 
and  maintenance  is  that  the  provisions 
of  the  FOIP  Act  and  of  the  RMR  will 
apply  to  the  records  so  created  and 
maintained. 

In  a different  version  of  the  same 
example,  the  public  body  might  not 
specify  a need  of  access  to  the 
contractor's  records  but  rather  use  the 
contract  to  specify  particular  reports  the 
contractor  will  be  required  to  supply 
which  will  serve  as  measures  of 
performance.  In  this  instance,  the  FOIP 
Act  and  RMR  would  apply  only  to  the 
records  required  of  the  contractor, 
namely  the  performance  reports  and  any 
financial  data  needed  to  account  for  the 
spending  of  public  funds. 

Relinquishing  Custody  or  Control 

It  is  important  to  note  that  the  custody 
or  control  of  records  can  be  reduced 
through  a contract  or  other  legal 
agreement.  However,  the  legal 
requirements  of  the  FOIP  Act  and  the 
RMR  may  continue  to  apply.  Even  in 
cases  of  privatization,  records  created 
when  the  service  or  operation  was  part 
of  a public  body  and  transferred  as  part 
of  the  privatization  process  remain 
subject  to  the  basic  legal  requirements 
relating  to  freedom  of  information  and 
protection  of  privacy  and  the  disposition 
requirements  of  the  RMR.  Public 


bodies  should  incorporate  effective  and 
financially  prudent  ways  to  ensure  that 
freedom  of  information,  protection  of 
privacy  and  records  management 
requirements  are  met  in  contracts  and 
agreements. 


4 


June  1997 


Contracting  Guide  for  FOIP  and  Records  Management 


2.  CONTRACTING  AND  FREEDOM 
OF  INFORMATION 

Overview 

The  contracting  process  has  three  basic 
components  — a planning  stage,  an 
RFP  or  tendering  stage  and  a contract 
award  stage.  Depending  on  the 
magnitude  and  complexity  of  the 
contract,  these  stages  may  be  either 
telescoped  into  a very  short  process 
(e.g.,  a simple  service  contract  for  a 
small  amount)  or  be  extended  into  a 
major  project  requiring  an  extensive 
management  framework  (e.g.,  a large 
outsourcing  contract  or  privatization  of 
a large  government  service  facility). 

Freedom  of  information,  protection  of 
privacy  and  records  management  issues 
should  be  considered  at  every  stage  in 
the  contracting  process.  A FOIP  and 
Records  Management  Checklist  for 
Contract  Managers  is  provided  in 
Appendix  A.  The  Checklist  poses 
crucial  questions  in  relation  to  freedom 
of  information,  protection  of  privacy 
and  records  management  issues  which 
should  be  dealt  with  in  planning 
contractual  arrangements,  dealing  with 
RFPs  and  tenders  and  in  awarding  a 
contract. 

Part  1 of  the  FOIP  Act  establishes  new 
requirements  which  must  be  taken  into 
account  in  the  contracting  process. 
These  are  summarized  as  follows. 

The  Act  applies  to  all  records  in  the 
custody  or  under  the  control  of  a public 
body,  unless  there  is  a specific 
exclusion  of  the  type  of  record  in 
section  4 of  the  legislation.  Thus 
records  specifically  produced  on  behalf 


of  a public  body  are  subject  to  the  Act’s 
access  provisions  (section  4). 

Further,  the  Act  prevents  a public  body 
from  ensuring  absolute  confidentiality 
of  documents  submitted  to  it  by 
contractors  in  response  to  RFPs  or 
similar  invitations  to  make  a quote  or 
proposal  (section  15). 

Finally,  the  definition  of  employee  in 
section  1 of  the  Act  establishes  that 
persons  retained  under  contract  to 
perform  services  for  a public  body  are 
to  be  considered  employees  for 
purposes  of  the  legislation  (section 
l(l)(e)). 

These  legal  provisions  make  it  essential 
that  the  various  conditions  relating  to 
freedom  of  information  be  recognized 
in  RFP  or  tendering  documents  and  in 
the  contract  itself 

Specification  of  Custody  or 
Control  for  RFP  and  Tender 
Documents 

When  planning  a contract  or 
establishing  an  RFP  or  tender 
document,  a public  body  should  begin 
to  set  out  the  types  of  specific  records 
which  the  public  body  will  expect  to  be 
created,  obtained  and  maintained  under 
a contract  and  to  which  it  will  require 
access  for  operational  and  financial 
accountability  purposes.  This 
determines,  in  turn,  which  records 
created  or  obtained  by  a contractor  are 
under  the  control  of  the  public  body  or 
for  which  it  wishes  to  exercise  custody 
and  may  be  subject  to  the  access 
provisions  of  the  FOIP  Act. 
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Potential  Freedom  of  Information 
Responsibilities 

In  most  circumstances,  public  bodies 
will  expect  to  receive  and  will  exercise 
control  or  custody  over  reports,  studies, 
products,  service  summaries  and 
financial  details  produced  as  a result  of 
the  contractor's  work.  As  with  current 
contract  requirements,  they  may  ask 
that  these  be  produced  in  a certain  way 
or  to  a certain  standard.  Other 
situations  will  be  more  complicated; 
either  because  of  the  nature  of  the 
service  provided  or  because  the  public 
body  is  the  sole  client  of  the  contractor. 
In  such  instances,  there  may  be  good 
grounds  for  requiring  access  to  a wide 
range  of  contractor  files,  including 
financial  and  subcontracting  records,  in 
order  to  audit  or  inspect  performance. 

For  example,  a public  body  contracting 
for  family  care  services  might  demand 
access  to  licencing,  inspection,  senior 
personnel  and  financial  records  but 
might  not  wish  access  to  general  hiring 
and  facility  records. 

General  Conditions  Relating  to 
Contractors 

Some  considerations  which  should  be 
taken  into  account  when  determining 
what  records  should  remain  under  the 
control  of  the  public  body  for 
operational  purposes  are: 

• Is  there  information  which  must  be 
created  and  maintained  in 
accordance  with  statute?  Is  the 
public  body  bound  by  its  own 
legislation  and  regulations  to 
produce  certain  types  of  information 
which  must  be  under  its  custody  or 
control  and  what  are  the 


requirements  of  Officers  of  the 
Legislature  such  as  the  Auditor 
General? 

• Are  there  specific  records  which 
should  be  created  and  maintained 
under  the  control  of  the  public  body 
because  the  public  body  wishes  to 
have  access,  or  is  anticipating  that 
access  is  needed,  either  during  or 
beyond  the  life  of  the  contract? 

• Are  there  records  that  will  be 
required  for  the  purposes  of 
inspections,  financial  or  program 
audits? 

• What  are  the  annual  or  periodic 
reports  required  to  assure 
performance  measures  for  the 
contract  or  agreement  and  what  will 
be  their  content  and  format? 

Potential  contractors  responding  to  an 
RFP  or  tender  should  be  informed  of 
their  potential  responsibilities  for 
participating  in  a response  to  a FOIP 
request.  A useful  standard  clause  might 
be  as  follows: 

► The  records  stipulated  in  this  (RFP  or 
tender)  as  being  required  to  be 
maintained  or  submitted  by  the 
contractor  may  be  subject  to  the 
protection  and  access  provisions  of  the 
Freedom  of  Information  and  Protection 
of  Privacy  Act.  Should  (name  of  public 
body)  receive  a request  for  any  of  these 
records,  it  would  be  your  responsibility 
to  provide  the  records,  at  your  expense, 
to  the  (name  of  position  in  public  body) 
within  (number)  of  calendar  days  from 
official  notification  by  the  (name  official). 

Collection  of  Personal 
Information 

In  some  cases,  RFPs  may  require  the 
submitter  to  provide  personal 
information  about  those  individuals 
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who  will  be  involved  with  a project  and 
to  provide  ratings  and  evaluations  of 
their  abilities  and  work  history.  It  is 
assumed  that  employees  or  associates  of 
a potential  contractor  have  provided  the 
information  for  purposes  of  making  a 
proposal  in  order  to  win  a contract  or 
tender.  The  provision  of  such 
information  therefore  may  be 
considered  as  a direct  collection  of 
personal  information  for  purposes  of 
section  33  of  the  FOIP  Act.  This 
section  requires  that  an  individual  be 
informed  about  the  authority  and 
purpose  of  the  collection  of  personal 
information  (section  33(2)).  A notice  of 
authority  to  collect  along  the  lines  of 
the  following  should  appear  in  the 
introductory  section  of  the  RFP  or 
tender  documentation: 

► The  purpose  for  collecting  the  personal 
information  required  to  be  provided  in 
this  (RFP  or  tender  document)  is  to 
enable  (name  of  public  body)  to  ensure 
the  accuracy  and  reliability  of  the 
proposal,  and  to  enable  the  (name  of 
public  body)  to  evaluate  your  response 
to  this  (RFP  or  tender  document)  and 
for  other  related  program  purposes  of 
the  (name  of  public  body).  Authority  for 
this  collection  is  (name  of  statute  and 
section(s)).  You  may  contact  the 
(name  of  appropriate  officer)  at 
(address  and  phone  number)  if  you 
have  any  questions  about  the  collection 
of  information  pursuant  to  this  (RFP  or 
tender  document). 

If  the  information  will  be  used  for  any 
other  purposes,  these  uses  must  be 
included  in  this  contract  clause. 

Contract  Clauses 

The  conditions  established  in  an  RFP  or 
tender  document  should  be  augmented 
by  clauses  relating  to  the  access 
provisions  of  the  FOIP  Act  which 


should  be  precisely  specified  in  the 
contract  document  itself.  See 
Appendix  B,  section  2 for  examples  of 
these  clauses. 

Disclosure  of  Contract 
Documents 

Confidentiality:  It  is  important  that  all 
contractors  are  clearly  informed  that 
public  bodies,  because  of  the  access 
provisions  of  the  FOIP  Act,  can  no 
longer  ensure  complete  confidentiality 
for  any  document  once  it  is  submitted 
and  accepted  by  the  body.  This 
includes  documents  which: 

• are  stamped  "confidential"  or  "in 
confidence"; 

• contain  a non-disclosure  clause;  or 

• have  copyright,  although  an 
applicant  requesting  the  record 
would  be  informed  of  the  copyright 
restrictions  applying  to  the  record. 

At  least  one  complete  copy  of  the 
proposal  must  be  kept  on  file  as  a record 
of  the  RFP  or  tendering  process. 

This  does  not  mean  that  those  who 
submit  documentation  should  be  left 
with  the  impression  that  all  their 
information  will  automatically  be 
disclosed.  Submitters  should  be 
informed  that,  if  a FOIP  request  is  made 
for  their  records,  a number  of 
exceptions  outlined  in  the  Act  may  be 
applied,  including  section  15,  third 
party  business  information,  and  section 
16,  unreasonable  invasion  of  personal 
privacy.  These  latter  exceptions  give 
the  submitter  an  opportunity  to 
comment  on  the  disclosure  of  the 
records  before  access  is  provided. 
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As  well,  submitters  should  be 
encouraged  to  identify  appropriate  parts 
of  their  submissions  as  confidential, 
since  this  clearly  establishes  their 
expectations  toward  the  documents, 
both  to  the  public  body  and  to  the 
Information  and  Privacy  Commissioner 
in  any  review  of  a refusal  of  access. 
However,  the  public  body  may  not  be 
able  to  meet  these  expectations  in  every 
instance. 

For  example,  information  which  the 
contractor  wishes  to  protect  may  not 
qualify  for  any  exception  under  the  Act 
or  already  be  in  the  public  domain. 

There  may  also  be  issues  of  public 
interest  or  accountability  to  the  public 
which  must  be  met. 

Contractors  need  to  be  aware  of  the 
FOIP  implications  for  their  documents 
as  early  as  possible  in  the  contracting 
process.  The  RFP  or  tender  documents 
should  contain  a clause  along  the 
following  lines: 

► All  documents  submitted  to  the  (name 
of  public  body)  are  subject  to  the 
protection  and  disclosure  provisions  of 
the  Freedom  of  Information  and 
Protection  of  Privacy  Act.  While  this 
Act  allows  persons  a right  of  access  to 
records  in  the  (public  body’s)  custody  or 
control  it  also  prohibits  the  (name  of 
public  body)  from  disclosing  your 
personal  or  business  information  where 
disclosure  would  be  harmful  to  your 
business  interests  or  would  be  an 
unreasonable  invasion  of  your  personal 
privacy  as  defined  in  sections  15  and 
16  of  the  Act.  Applicants  are 
encouraged  to  identify  what  portions  of 
their  submissions  are  confidential  and 
what  harm  could  reasonably  be 
expected  from  its  disclosure. 


The  above  statement  will  alert 
contractors  to  the  fact  that  their 
information,  once  submitted,  may  be 
disclosed  to  the  public  if  requested  and 
the  public  body  is  unable  to  withhold  it 
unless  it  can  be  specifically  excepted 
under  the  Act. 

When  a formal  FOIP  request  is  received 
for  information  on  the  contracting 
process,  it  is  important  to  consider 
whether  documents  can  be  released  as  a 
matter  of  course  or  if  they  should  be 
subject  to  the  provisions  of  the  FOIP 
Act.  If  a requested  record  must  be 
severed,  the  request  should  be  handled 
as  a formal  FOIP  request. 

Most  contract  documents  contain  some 
information  that  can  be  disclosed  and 
some  that  must  be  withheld  because  one 
or  more  of  the  following  exceptions 
apply: 

Section  15  - Disclosure  harmful  to  the 
business  interests  of  a third 
party; 

Section  16  - Disclosure  harmful  to 
personal  privacy; 

Section  18  - Confidential  evaluations 
(awarding  of  government 
contracts); 

Section  23  - Advice  from  officials;  and 

Section  24  - Disclosure  harmful  to 
economic  and  other 
interests  of  the  government 
or  a public  body. 

This  is  not  to  say  that  all  contract 
related  records  can  be  withheld  from  the 
public  in  their  entirety.  For  example,  in 
regard  to  section  15,  a record  is 
required  to  meet  three  tests:  it  must 
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contain  trade  secret,  commercial, 
financial,  scientific  or  technical 
information;  be  supplied  by  the  third 
party  business  in  confidence;  and  cause 
harm  or  reveal  information  as  provided 
in  the  provision.  Usually,  this  results  in 
only  part  of  the  record  qualifying  for  the 
exception  and  information  that  must  be 
withheld  is  severed  from  those  portions 
of  the  records  which  can  be  disclosed. 

The  types  of  records  involved  in  the 
contracting  process  are  described  below 
with  suggestions  as  to  how  the 
provisions  of  the  FOIP  Act  might  apply 
to  them.  It  must  be  noted,  however, 
that  this  is  only  a guide  to  the 
application  of  the  AcL  Each  situation 
must  be  evaluated  individually.  The 
guidance  is  summarized  in  a chart 
provided  in  Appendix  C. 

Public  tender  documents  are  generally 
available  to  interested  contractors  and 
the  general  public  free  of  charge. 
Opportunities  posted  on  the 
government’s  electronic  tendering 
service  may  require  payment  of  a fee  to 
download  documents  from  the  system. 

Invitations  to  bid,  RFPs,  evaluation 
criteria  and  lists  of  contractors  invited 
to  submit  bids  or  proposals  are 
generally  public  documents  and 
available  to  the  public. 

Minutes  of  "vendor  briefings"  held  prior 
to  contractors  submitting  tenders  are 
generally  distributed  to  those  in 
attendance  at  the  meeting  and,  as  such, 
are  available  to  the  public  upon  request. 

Lists  of  contractors  who  submitted 
bids/proposals  are  available  to  the 
public  after  the  solicitation  period 


closes.  Prior  to  that  point  there  may  be 
ongoing  negotiations  with  one  or  more 
potential  contractors. 

The  total  price  of  the  tender  is  generally 
public  information  but  the  unit  prices 
are  sometimes  not  released.  Making 
unit  price  information  public  may  be 
harmful  to  the  business  interests  (e.g., 
competitive  position)  of  a contractor 
(section  15).  In  addition,  it  could  also 
be  harmful  to  the  economic  interests  of 
the  government  or  a public  body 
(section  24).  Release  of  such 
information  could  reduce  the 
competitiveness  of  bids  for  that  type  of 
work  in  the  future  and/or  could  result  in 
that  type  of  information  no  longer  being 
supplied  by  the  contractor  when  it  is 
otherwise  beneficial  that  they  do  so. 

Proposals  are  not  generally  available  to 
the  public  and  are  seldom  released  in 
their  entirety.  Proposals  usually  contain 
some  information  that  would  be  harmful 
to  the  business  interests  of  the 
contractor,  if  released  (e.g., 
methodology  or  cost  breakdowns). 
Section  15  of  the  Act  has  a three  part 
test  that  must  be  met  to  except  this  type 
of  information.  First,  records  must 
contain  trade  secret,  scientific, 
technical,  commercial  or  financial 
information.  Second,  the  information 
must  have  been  supplied  either 
explicitly  or  implicitly  "in  confidence". 
Third,  the  information  must  satisfy  a 
harms  test  that  its  release  could 
reasonably  be  expected  to: 

• significantly  harm  the  competitive 
position  of  a third  party; 

• significantly  interfere  with  the 
negotiating  position  of  a third  party; 
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• result  in  similar  information,  which 
is  required,  no  longer  being  supplied 
to  the  public  body; 

• result  in  undue  financial  loss  or  gain 
to  any  person  or  organization;  or 
reveal  information  related  to  the 
inquiries  into  and  resolution  of 
labour  relations  disputes. 

Where  all  or  part  of  a record  meets 
these  criteria  there  are  grounds  for  a 
refusal  of  access  under  section  15. 

The  decision  concerning  release  may  be 
made  either  by  the  public  body  alone  or 
after  third  party  consultation  with  the 
contraetor.  In  either  case,  the  harms  test 
must  be  satisfied  by  the  provision  of 
concrete  evidence;  third  party 
submissions  which  simply  reflect 
conjecture  will  not  suffice.  The  harm 
must  be  significant  and  likely.  As 
indicated  above,  failure  to  provide 
sufficient  evidence  as  to  the  specific 
harms  will  not  result  in  the  successful 
application  of  section  15. 

Certain  parts  of  the  proposal  may  also 
be  excepted  on  the  basis  that  it  may  be 
harmful  to  personal  privacy.  This  may 
occur  where  information  about  an 
identifiable  individual  is  provided  (e.g., 
a resume  of  a member  of  a project 
team).  Information  of  this  nature  which 
is  subject  to  section  16  of  the  Act  must 
be  severed  or  removed  from  the 
remainder  of  the  records  prior  to 
disclosure. 

Eval uation  sheets/notes/summahes/ 
weighting  factors  and  other  evaluation 
documents  are  based  on  information 
supplied  by  the  contractor  but  they  are 
created  by  the  public  body.  As  a result 


not  all  the  records  qualify  for 
consideration  for  exception  under 
section  15.  However,  some  of  these 
records  may  be  subject  to  the  exception 
in  section  18  if  they  contain  evaluative 
or  opinion  material  supplied,  explicitly 
or  implicitly,  in  confidence  (e.g., 
references  given  in  confidence  about  a 
contractor's  suitability  or  confirmation 
of  qualifications).  They  may  also  be 
subject  to  the  exception  in  section  23  if 
they  reflect  the  advice  or 
recommendations  of  public  servants  as 
to  a suggested  course  of  action  (e.g., 
recommendation  as  to  which  firm 
would  be  offered  a contract).  Such 
information  may  be  severed  from 
records  at  the  discretion  of  the  public 
body,  if  it  meets  the  criteria  in  section 
23. 

The  names  and  position  titles  of 
employees  of  a public  body  who  were 
part  of  the  rating  committee  are  also  not 
subject  to  exception.  These  individuals 
produced  the  rating  assessment  on 
behalf  of  the  public  body  and  as  part  of 
their  duties  as  government  employees. 
As  such,  the  information  is  not 
considered  to  be  personal  information. 

Tender  tabulation  records  showing 
individual  unit  prices  are  not  always 
disclosed.  A summary  sheet  produced 
as  part  of  the  overall  tender  report  can 
be  released  once  any  estimate  by  the 
public  body  has  been  severed.  The 
public  body  estimate  and  the  unit  prices 
may  be  excepted  under  section  24  of 
the  Act,  disclosure  harmful  to  the 
economic  and  other  interests  of  the 
government  or  a public  body. 

Negotiating  information  may  be 
excepted  as  advice  from  officials  or 
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harm  to  a public  body’s  economic 
position  as  provided  in  sections  23  and 
24  as  well  as  the  protection  of  business 
interests  of  a third  party,  section  15. 

The  contract  (including  the  amount 
payable)  that  is  established  with  the 
winner  of  the  RPP,  tendering  or  other 
proposal  process  is  generally  releasable, 
subject,  to  possible  exceptions  for 
information  that  may  qualify  as  harming 
the  business  interests  of  a third  party 
(section  15),  or  invading  personal 
privacy  (section  16)  and/or  harming  the 
economic  interests  of  a public  body 
(section  24). 
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3.  CONTRACTING  AND  PRIVACY 
PROTECTION 

Overview 

To  the  extent  that  a contract  deals  with 
the  collection,  use  or  disclosure  of 
personal  information,  Part  6 of  the 
FOIP  Act  requires  that  the  privacy 
provisions  set  out  in  Part  2 of  the 
legislation  be  applied  to  that  personal 
information. 

This  means  that  public  bodies  must 
ensure  that  their  obligations  in 
regard  to  privacy  protection  are 
carried  out  by  contractors  handling 
personal  information. 

The  FOIP  Policy  Manual  states  that 
contracts  must  stipulate  clearly  the 
requirements  governing  the  collection, 
compilation,  accuracy,  protection,  use, 
access,  disclosure,  correction  and 
disposal  of  personal  information 
imposed  by  the  Act  on  the  public  body 
and  assumed  by  the  contractor. 

In  addition,  where  a contractor  is 
collecting  personal  information  on 
behalf  of  a public  body,  the  contract 
must  stipulate  how  the  requirements 
under  the  Act  will  be  met  by  the 
contractor  or  organization  in  regard  to 
controls  relating  to  the  use,  disclosure, 
security  and  retention  and  disposition  of 
the  personal  information  being 
collected. 

RFP  and  Tender  Documents 

Most  contractors  working  for  public 
bodies  are  not  involved  in  the 
collection,  use  and  disclosure  of 
personal  information.  However,  where 


this  is  the  case,  the  RFP  or  tender 
documents  should  recognize  this  and: 

• inform  the  contractor  that  the 
winning  bidder  will  be  accepting  the 
same  responsibilities  for  protecting 
the  personal  privacy  of  individuals 
as  set  out  in  Part  2 of  the  FOIP  Act; 
and 

• request  the  approach  or  plan  through 
which  the  contractor  would  propose 
to  meet  these  statutory  obligations. 

An  important  first  step  for  FOIP 
Coordinators,  Contract  Managers  and 
Program  Managers  is  to  consider  fully 
whether  a contractor  needs  to  collect  or 
have  access  to  personal  information. 
Privacy  protection  is  a serious  and 
complicated  business  which  may  add 
costs  to  the  contractor’s  operations  and 
may  reduce  the  contract  value  to  the 
public  body.  There  are  both  economic 
and  privacy  protection  considerations 
which  weigh  against  a contractor  being 
requested  to  collect  and/or  handle 
personal  information  unless  it  is 
absolutely  essential  to  the  business  and 
operational  objectives  being 
accomplished  through  the  contract. 

Part  2 of  the  FOIP  Act  places  an 
obligation  on  the  head  of  each  public 
body  to  ensure  the  protection  of  privacy 
of  individuals  through  application  of 
sections  32  to  39  of  the  Act.  A section 
should  be  added  to  any  RFP  or  tender 
document  that  is  requesting  proposals 
which  require  the  collection  and/or 
handling  of  personal  information  by  the 
contractor  in  the  performance  of  duties 
or  the  offering  of  services  as  follows: 
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► The  contractor  will  meet  the  standards 
set  by  the  requirements  of  Part  2 of  the 
Freedom  of  Information  and  Protection 
of  Privacy  Act,  in  so  far  as  they  are 
applicable  to  its  operations  and  the 
personal  information  the  contractor  has 
access  to,  collects,  or  uses,  as  a 
consequence  of  carrying  out  its 
obligations  under  the  contract. 

► The  Freedom  of  Information  and 
Protection  of  Privacy  Act  requires  the 
protection  of  the  privacy  of  individuals 
whose  information  may  be  involved  with 
meeting  contract  requirements.  In 
accordance  with  the  standards 
established  by  the  requirements  of  Part 
2 of  the  Act,  the  contractor  will  be 
required  to  protect  the  confidentiality 
and  privacy  of  each  individual's 
personal  information  accessible  to  the 
contractor  or  collected  pursuant  to  the 
(RFP  or  tender  document)  or  this 
contract. 

► The  contractor  shall  include  in  its 
response  to  this  (RFP  or  tender 
document)  a detailed  plan  describing 
measures  to  meet  each  of  the  following 
requirements,  as  appropriate  to  the 
proposal: 

• manner  of  collection; 

• notification  of  collection  purposes; 

• assurance  of  accuracy; 


► The  authority  and  purposes  for  any 
collection  of  personal  information  in 
regard  to  this  project  are  as  follows  (set 
out  authority  and  purpose  statement). 
Further  information  regarding  privacy 
protection  measures  and  this  project 
may  be  obtained  from  (name,  address 
and  communication  numbers  of 
appropriate  official). 

The  privacy  protection  measures 
proposed  by  the  contractor  must  meet 
the  requirements  of  Part  2 of  the  FOIP 
Act  and  the  protection  of  privacy 
guidelines  in  the  FOIP  Policy  Manual 
(and  any  appropriate  privacy  standards 
of  the  public  body). 

Since  section  32  of  the  Act  requires  that 
collection  of  personal  information  can 
occur  only  where  specific  authority  for 
the  collection  exists,  it  is  essential  to 
ensure  that  the  public  body  has  the 
appropriate  authority  to  collect  and  use 
the  personal  information  in  the  way 
intended  in  the  RFP  or  tender 
document.  This  will  normally  be  done 
through  consultation  among  the 
Program  Manager,  FOIP  Coordinator 
and  Contract  Manager. 


controls  over  uses  and  consistent 
uses; 

controls  over  disclosure  of  personal 
information; 

plans  and  controls  over  data 
matching  and  linkage; 

provision  for  retention  and  disposal 
of  personal  information;  and 

protection  of  personal  information 
from  unauthorized  access, 
collection,  use,  disclosure  or 
disposal. 


As  indicated  earlier,  a project  may  not 
involve  all  aspects  of  the  collection,  use 
and  disclosure  of  personal  information. 
The  requirements  of  the  RFP  or  similar 
documentation  should  reflect  only  those 
aspects  relevant  to  the  project. 

For  example,  if  a contractor  will  simply 
be  given  access  to  certain  personal 
information  then  the  controls  over 
collection,  accuracy,  retention,  etc.  will 
not  apply.  The  requirements  should  be 
restricted  to  controls  over  the  use, 
disclosure,  linkage  and  protection  of  the 
personal  information. 
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Contract  Clauses 

The  appropriate  privacy  protection 
measures  for  personal  information 
identified  in  the  RFP  or  tender 
documents  should  be  specified  in  the 
contract  document.  It  is  important  to 
note  that  a public  body  is  essentially 
delegating  its  privacy  protection 
responsibilities  to  a contractor.  Thus  in 
most  instances  it  is  advisable  to  repeat 
the  wording  of  the  provisions  of  Part  2 
of  the  FOIP  Act  which  are  applicable  to 
the  circumstances  of  the  agreement  in 
the  contract  terms.  Suggestions  for 
clauses  that  deal  with  protection  of 
privacy  matters  are  provided  in 
Appendix  B,  section  2. 
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4.  CONTRACTING  AND  RECORDS 
MANAGEMENT 

Overview 

The  RMR  applies  to  records,  including 
records  transferred  to  or  created, 
obtained  and  maintained  by  a 
contractor,  that  are  under  the  control  of 
a public  body. 

As  discussed  earlier,  when  planning  a 
contract  or  establishing  an  RFP  or 
tender  document,  a public  body  should 
begin  to  set  out  the  types  of  specific 
records  which  the  public  body  will 
expect  to  be  created,  obtained  and 
maintained  under  a contract  and  to 
which  it  will  require  access  for 
operational  and  financial  accountability 
purposes. 

Where  record  keeping  forms  a major 
part  of  a proposal,  the  RFP  or  tender 
documents  should  include  it  as  an  item 
to  be  assessed  and  evaluated  by  a bidder 
in  regard  to  both  cost  and  methodology. 

RFP  and  Tender  Documents 

It  is  important  to  identify  at  an  early 
stage  which  records  produced  by  a 
contractor  pursuant  to  the  contract  or 
agreement  need  to  be  under  the  control 
of  the  public  body.  The  RFP  or  tender 
documents  should  stipulate: 

• what  types  of  records  the  contractor 
will  be  expected  to  create,  obtain  or 
use  pursuant  to  the  contract;  and 

• what  types  of  records  over  which 
the  public  body  will  wish  to 
exercise  custody  or  control  in  order 
to  meet  both  operational  and 
accountability  purposes. 


Except  in  extraordinary  circumstances, 
for  example,  in  cases  of  outsourcing 
where  the  contractor  is  taking  over 
delivery  of  a government  program  or 
service  on  a contract  basis,  it  is  not 
practical  from  the  point  of  view  of 
either  the  public  body  or  the  contractor 
to  fully  duplicate  government  records 
management  practices  for  most 
contracts. 

Where  appropriate,  however,  the  RFP 
or  tender  documents  should  either 
establish  any  particular  records 
management  practices  required,  or 
request  that  the  contractor’s  proposal 
explain  the  plans  for  managing  the 
records.  The  documents  should  also 
indicate  the  processes  to  be  used  by  the 
public  body  to  access  records  for 
operational  purposes  (i.e.,  whether  on- 
site inspection  or  transfer  of  records  to 
the  public  body). 

In  some  instances,  it  may  also  be 
necessary  to  transfer  records  between 
the  public  body  and  the  contractor  when 
a contractual  arrangement  or  contract 
deals  with  the  delivery  of  an  existing 
service.  For  example,  the  contractor 
may  require  personnel  or  client  files,  or 
databases  related  to  the  program  or 
service.  Again  specific  provision 
should  be  made  in  the  contract  or 
agreement  for  the  ownership,  custody, 
control,  security,  return,  disposition  or 
destruction  of  such  records.  In  most 
instances,  except  where  privatization  is 
involved,  these  records  should  remain 
under  the  control  of  the  public  body. 
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Every  proposal  will  have  to  be 
evaluated  individually  to  determine  the 
types  of  records  that  will  be  created, 
obtained  or  maintained  and  the  level  of 
access  required  for  operational 
purposes.  These  conditions  will  depend 
on  the  nature  of  the  service  being 
provided,  the  type  of  contractor 
involved,  and  the  accountability 
requirements  from  both  a program  and 
financial  perspective. 

There  are  a number  of  questions  which 
should  be  posed  and  answered  in 
relation  to  records  management  at  the 
planning  stage  of  any  major  contract 
(usually  some  standard  phrases  will 
handle  these  issues  in  simple  service 
contracts).  These  are: 

• How  does  this  contract  fit  into  the 
business  objectives  and  activities  of 
the  program  involved?  Is  this  a 
project  requiring  extensive 
operational  controls  over  the 
activities  of  the  contractor  or  less 
rigorous  reporting  and  production  of 
reports  along  with  normal  financial 
controls? 

• Given  the  overall  objectives  of  the 
contract,  what  records  will  the 
contractor  be  asked  to  create  and 
maintain?  For  how  long?  Do  these 
requirements  meet  the  public  body's 
expectations  for  the  maintenance  of 
custody  or  control  for  operational 
and  financial  purposes? 

• What  will  happen  to  the  records  if 
the  contract  is  cancelled  or  the 
contractor  fails  or  goes  bankrupt? 
Such  matters  must  be  dealt  with 
specifically  in  a contract. 


• If  records  are  being  transferred  to  a 
contractor,  what  are  the  specific 
requirements  as  to  ownership, 
organization,  custody,  control, 
security,  and  return  of  the  records? 

• Are  there  special  requirements  to 
segregate  project  files  from  other 
records  (that  is  do  records  need  to 
be  separated  physically  and/or 
systematically  from  other  records 
created  or  maintained  by  the 
contractor)?  Is  there  a need  to 
provide  special  security  and  access 
controls? 

• How  long  should  records  be 
retained?  How  long  will  the  public 
body  require  access  to  the  records 
and  for  what  reasons?  As  a 
minimum,  contractors  should  be 
required  to  retain  records  for  the 
duration  of  the  contract.  If  it  is 
anticipated  that  records  will  be 
needed  for  a longer  time,  this  should 
be  clearly  stipulated  in  both  the 
proposal  and  the  agreement  or 
contract. 

• What  is  the  authority  for  retention 
and  disposition  of  the  records? 
Should  authority  be  given  to  provide 
for  the  disposition  of  transitory 
records  that  relate  to  records  that 
may  be  under  the  custody  or  control 
of  the  public  body?  Transitory 
records  are  defined  in  the  Alberta 
Public  Works,  Supply  and  Services 
publication  entitled  Records 
Scheduling  and  Disposition  in  the 
Government  of  Alberta  as  records 
in  any  media  that: 

- have  only  temporary  usefulness; 
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- are  not  part  of  an  administrative 
or  operational  records  series; 

- are  not  regularly  filed  in  a 
records  or  information  system; 
and 

- are  required  only  for  a limited 
period  of  time  for  the 
completion  of  a routine  action  or 
the  preparation  of  a record. 

Common  transitory  records  are 
telephone  messages,  simple 
instructions,  rough  notes,  draft 
documents  and  duplicate  records 
and  reports. 

• Should  records  remain  in  the 
custody  of  a contractor  after  the 
contract  or  agreement  is  no  longer  in 
effect?  The  decision  here  should 
take  a number  of  factors  into 
account: 

- how  long  does  the  public  body 
anticipate  needing  the  records; 

- what  will  be  the  frequency, 
complexity  and  type  of  access 
required  and  is  this  best  done  by 
the  contractor  or  the  public 
body; 

- what  are  the  complexities  of  the 
records  management  processes 
required  and  are  these  most 
effectively  and  economically 
done  by  the  contractor  or  public 
body; and 

- what  are  the  overall  cost 
implications  of  having  the 
contractor  maintain  records  for 
an  extended  time  (e.g.,  storage, 
retrieval  and  other  costs)  versus 
storage  by  the  public  body  (e.g., 
storage  space,  staff  resources 


and  unfamiliarity  with  the 
records)? 

• How  will  records  be  disposed  of 
when  the  time  period  for  retention 
has  expired?  Records  are  disposed 
of  either  through  transfer  to  the 
Provincial  Archives  of  Alberta  or 
through  destruction.  The  scheduling 
process  is  designed  to  identify 
records  which  may  have  historical 
or  long-term  value.  There  needs  to 
be  a way  to  ensure  that  such  records 
are  transferred  to  the  appropriate 
archival  authority.  At  the  same 
time,  there  needs  to  be  adequate 
controls  over  the  destruction  of 
records  containing  sensitive  and 
confidential  information  and 
personal  information,  in  all  formats. 

The  answers  to  these  questions  will  aid 
the  public  body  in  identifying  the  issues 
that  will  have  to  be  addressed  in  the 
RFP  or  tender  documentation  and,  later, 
in  the  contract  document. 

If  records  management  requirements  are 
extensive,  they  should  be  identified  as 
part  of  the  costing  criteria  for  the 
proposal. 

Records  Scheduling 

Any  final  contract  should  specify  a 
retention  period  for  the  records 
transferred,  created  or  obtained  under  its 
auspices  and  which  are  considered  to  be 
in  the  custody  or  under  the  control  of  a 
public  body.  The  SRO  of  the  public 
body  should  be  involved  in  the  planning 
stage  of  the  contract  to  ensure  that 
records  scheduling  requirements  are 
addressed. 
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For  simple  service  contracts,  a records 
retention  and  disposition  schedule 
should  be  established  which  permits  the 
contractor  to  dispose  of  records  after  a 
period  of  time  when  the  public  body  has 
no  more  operational,  administrative  or 
financial  need  for  the  records. 

Where  a major  part  of  a proposal  or 
contract  deals  with  the  transfer  or 
creation  and  collection  of  records,  the 
public  body  should  establish  a schedule, 
which  meets  the  special  circumstances 
of  the  contract  or  agreement.  This 
should  be  done  as  soon  as  possible 
during  the  RFP,  tendering  or  contract 
award  stages  of  a contracted  project.  To 
the  extent  possible,  scheduling 
arrangements  should  be  mentioned  in 
the  RFP  or  tender  documents  and 
should  be  referenced  in  the  contract 
document. 

As  well,  because  of  the  sensitivity 
surrounding  the  disposition  of  records, 
contract  documents  should  stipulate  that 
the  contractor  cannot  dispose  of  records 
except  through  notification  of  an 
appropriate  official  in  the  public  body 
who  can  authorize  such  disposition  and 
receipt  of  written  approval  from  that 
official  prior  to  actually  destroying  the 
records.  Where  information  of  a 
sensitive  or  confidential  nature  or 
personal  information  is  involved,  the 
SRO  of  the  public  body  should  provide 
advice  and  generally  supervise  the 
disposition  process.  A public  body  may 
also  wish  to  have  the  records  transferred 
to  its  custody  for  appropriate 
disposition. 


Contract  Clauses 

Records  management  requirements  in 
contracting  can  be  quite  varied,  and 
often  specific  conditions  and  clauses 
will  have  to  be  developed  for  both  RFP 
or  tender  documents  and  for  the  contract 
itself  See  Appendix  B,  sections  la  and 
2 for  suggestions. 
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5.  OUTSOURCING 
Overview 

Outsourcing  is  now  a popular  approach 
to  service  delivery  for  public  bodies. 
This  involves  moving  all  or  a 
significant  part  of  a service  previously 
delivered  by  government  over  to 
delivery  by  another  level  of 
government,  non-profit  public 
organizations  or  the  private  sector 
which  are  paid  contracted  sums  for 
providing  the  service  and  assuming  the 
overhead  and  other  costs  associated 
with  it.  Such  an  approach  has  been 
used  for  the  delivery  of  information 
technology  services  and  is  expanding 
into  a broad  range  of  operational  areas 
as  diverse  as  health,  safety  and  technical 
inspections  to  the  operation  of  programs 
or  facilities. 

Such  contracts  require  basically  the 
same  approaches  toward  proposals  and 
contract  or  agreement  documents  as 
described  above  and  the  same 
disclosure  provisions  apply.  The  major 
difference  is  that  such  contracts  are 
usually  more  detailed  and  complex  and 
require  more  attention,  especially  with 
regard  to  records  management  and, 
where  personal  information  is  involved, 
to  protection  of  privacy.  Where  a 
service  was  formerly  delivered  directly 
by  the  government  there  is  a strong 
public  interest  in  recognizing  that  the 
FOIP  Act  and  the  RMR  should  apply  to 
all  the  records  transferred,  created, 
obtained  and/or  maintained  as  a result 
of  an  outsourcing  activity. 

All  outsourcing  contracts  dealing  with 
the  delivery  of  government  services 
should  contain  a section  on: 


a)  records  management,  which  deals  at 
an  appropriate  level  of  detail  with 
the  nature  of  the  records  subject  to 
the  contract  or  agreement,  the 
ownership  of  those  records  and 
standards  relating  to  their 
management  and  disposition, 
including  approval  of  records 
retention  and  disposition  schedules 
for  such  records  through  the  Alberta 
Records  Management  Committee. 
Records  management  standards, 
with  the  exception  of  the 
requirement  to  schedule  and  dispose 
of  records,  may  either  reflect  the 
records  management  standards  of 
the  public  body  or  special  standards 
developed  for  the  contract  or 
agreement. 

b)  freedom  of  information,  which 
indicates  that  the  records  are  subject 
to  the  access  provisions  of  the  FOIP 
Act  and  assigns  responsibilities  and 
standards  for  responding  to  FOIP 
requests. 

c)  protection  of  privacy,  which 
establishes  standards  for  the 
protection  of  personal  information 
which  meet  the  requirements  of 
Part  2 of  the  FOIP  Act  and  the 
protection  of  privacy  guidelines  in 
the  FOIP  Policy  Manual. 
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6.  USE  OF  PERSONAL 
INFORMATION  BY  A 
CONTRACTED  AGENT  OF 
ANOTHER  PUBLIC  BODY 

Overview 

Situations  have  arisen  where  the 
information  normally  under  the  custody 
or  control  of  one  public  body  is  needed 
by  another  public  body  to  deliver  a 
service.  However,  this  service  is  being 
delivered  by  a contracted  agent,  which 
wishes  to  access  the  information 
directly.  Such  direct  access  is 
permissible,  provided  that  the  body 
disclosing  the  information  is  assured, 
through  review  of  the  contract,  that  the 
contractor  is  authorized  to  access  and 
use  the  information  and  is  responsible 
for  its  proper  handling. 

This  authorization  is  particularly 
important  where  personal  information  is 
involved  and  the  disclosing  body  should 
be  assured  that  both  the  other  public 
body  and  its  contracted  agent  are 
meeting  all  appropriate  requirements 
regarding  the  collection,  accuracy  and 
completeness,  protection,  use, 
disclosure  and  retention  of  personal 
information. 


7.  PUBLIC  BODY  ACTING  AS 
AGENT 

Overview 

To  the  extent  that  a public  body 
provides  services  to  other 
organizations  which  are  not  covered 
by  the  FOIP  Act,  they  need  to 
inform  such  organizations  that 
records  exchanged  in  the  provision 
of  those  services  will  be  subject  to 
the  Act  and  that  the  public  body 
cannot,  therefore,  ensure  complete 
confidentiality  for  such  records. 
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8.  JOINT  SERVICE  DELIVERY 
Overview 

It  has  been  the  practice  for  many  years 
for  various  levels  of  government  to 
cooperate  in  the  delivery  of  government 
programs.  In  the  delivery  of  social 
benefits,  for  example,  it  is  common  for 
the  provincial,  federal  and  municipal 
governments  to  partner  in  the  delivery 
of  services.  Another  development  has 
been  the  establishment  of  common 
service  centres  where  citizens  can 
obtain  one-stop  shopping  for  a 
particular  program  or  sector  (e.g.,  a 
business  centre  providing  a number  of 
services  relating  to  economic 
development  originating  from  different 
levels  of  government  but  offered 
through  a single  site).  There  has  also 
been  movement  of  services  from  one 
level  of  government  to  another  in  order 
that  services  may  be  offered  more 
efficiently  and  closer  to  the  citizen. 

These  joint  service  delivery  initiatives 
are  varied  in  their  approach  and  format. 
It  is  the  business  and  program 
objectives  which  a public  body  wishes 
to  accomplish  through  a shared  or  joint 
service  delivery  which  will  dictate  the 
extent  of  control  over  existing  records 
which  are  made  available  and  any 
records  created  or  obtained  during  the 
new  service  delivery  process. 

Regardless  of  the  approach  taken,  it  is 
important  to  set  out  the  nature  and 
extent  of  control  that  is  contemplated  in 
the  contract  since  this  determines  the 
extent  to  which  the  provisions  of  the 
FOIP  Act  and  the  RMR  will  apply  in  a 
particular  circumstance  and  what 
conditions  and  standards  apply  to  the 
records. 


Components  of  a Joint  Service 
Delivery  Contract 

Where  joint  service  delivery  is 
contemplated,  there  should  be  a written 
contract  among  the  joint  service 
providers  setting  out  the  terms  and 
conditions  for  the  service,  including 
responsibilities  for  freedom  of 
information  and  records  management. 
Current  government  policy  requires  that 
joint  service  delivery  contracts  be  in 
writing  (see  the  FOIP  Policy  Manual). 
Such  contracts  should: 

• stipulate  what  generic  types  of 
records  each  party  to  the  service 
contract  is  providing  in  order  to 
deliver  the  service.  This  is 
important  in  establishing  the 
concept  of  control  because  there 
may  be  several  parties  providing 
records; 

• stipulate  if  records  transferred  to 
another  authority  remain  the 
property  of  the  Government  of 
Alberta  and,  if  so,  that  the  FOIP  Act 
and  the  RMR  continue  to  apply  to 
them; 

• stipulate  that  any  amendment  to  the 
types  of  records  involved  may  only 
be  done  through  the  mutual  consent 
of  the  parties  involved  and  a copy  of 
any  amendment  will  be  provided  to 
the  SRO  of  the  public  body; 

• establish  all  the  administrative, 
technical,  and  physical  requirements 
and  safeguards  needed  to  assure 
good  management  and  protect  the 
confidentiality  of  the  records, 
including  separate  storage,  if 
appropriate,  in  order  to  facilitate 
application  of  the  RMR  and  the 
FOIP  Act, 
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• indicate  which  records  created  or 
obtained  through  joint  or  shared 
service  delivery  are  the  property  of 
the  Government  of  Alberta  and 
subject  to  the  FOIP  Act  and  the 
RMR.  Again  this  is  important  in 
establishing  the  concept  of  control 
for  particular  records,  where  several 
parties  are  involved; 

• stipulate  that  no  records  under  the 
control  of  the  public  body  shall  be 
destroyed  or  otherwise  disposed  of, 
or  transferred,  to  the  physical 
custody  of  any  other  jurisdiction 
without  the  written  consent  of  the 
public  body  and  the  Alberta  Records 
Management  Committee; 

• provide  that  any  requests  for  access 
to  records  deemed  to  be  under  the 
control  of  the  Government  of 
Alberta  or  the  public  body  will  be 
directed  to  the  public  body  within 
(number)  of  days  for  response, 
either  through  routine  disclosure  or 
through  processing  of  a FOIP 
request; 

• provide  that  on  receipt  of  a request 
for  access  to  records  under  the 
control  of  the  Government  of 
Alberta  or  the  public  body,  the 
public  body  will,  if  it  requires 
records  from  the  other  party,  notify 
that  party  and  the  records  shall  be 
provided  within  (number)  of  days 
from  the  date  of  the  notification; 

• stipulate  that  only  the  public  body 
has  the  power  to  determine  whether 
or  not  all  or  part  of  a record  will  be 
disclosed  after  consultation  with  the 
other  party; 

• stipulate  that  records  provided  in 
response  to  a request  will  be 


returned  to  their  source  location; 
and 

• provide  that  the  contract  may  be 
terminated  by  the  Government  of 
Alberta  or  the  public  body  within 
(number)  of  days  after  written 
notification  is  provided  to  the  other 
party  and  stipulate  that  upon 
termination  of  the  contract  all 
records  belonging  to  the 
Government  of  Alberta  will  either 
be  returned  to  the  public  body  or  be 
transferred  to  the  custody  and 
control  of  the  other  party  after 
approval  by  the  Alberta  Records 
Management  Committee. 

Additional  components  for  data  sharing 
contracts  in  regard  to  personal 
information  are  set  out  in  the  FOIP 
Implementation  and  Procedures 
Guide.  From  time  to  time  in 
negotiating  data  sharing  contracts  for 
personal  information,  especially 
between  the  provincial  and  federal 
governments,  it  is  sometimes  difficult  to 
resolve  which  jurisdiction's  privacy 
protection  measures  will  apply.  One 
solution  may  be  to  use  the  new 
Canadian  Standards  Association  Model 
Code  for  the  Protection  of  Personal 
Information  (CAN/CSA-Q830-96)  as 
the  standard  for  privacy  protection 
measures,  while  specific  issues  would 
be  dealt  with  under  the  particular 
privacy  statute,  federal  or  provincial,  to 
which  it  relates. 

For  example,  if  there  was  a request  for 
correction  of  personal  information,  it 
would  be  dealt  with  under  the  Alberta 
FOIP  Act,  if  the  request  were  made 
under  section  35  of  that  legislation. 
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It  should  be  noted  that  concepts  and 
contracts  for  joint  service  delivery  are 
evolving.  When  public  bodies  are 
planning  the  details  of  such  contracts, 
consultation  with  the  Information  and 
Privacy  Commissioner  may  be 
warranted. 


June  1997 


23 


Contracting  Guide  for  FOIP  and  Records  Management 


9.  PRIVATIZATION 
Overview 

In  some  instances,  public  bodies  are 
choosing  to  stop  delivering  services  and 
transferring  this  work  to  non- 
government bodies.  This  can  happen 
through  the  government  offering  the 
private  sector  the  opportunity  to  move 
into  the  service  field,  through  employee 
buy-outs,  the  turning  over  of  services  to 
another  level  of  government  or  non- 
profit organization  or  a combination  of 
all  these  approaches. 

This  is  a very  different  situation  from 
outsourcing.  In  this  instance  the 
balance  usually  shifts  to  market-based 
operations  in  which  the  government  and 
its  public  bodies  should  have  a much 
more  limited  involvement.  This  does 
not  mean  that  a public  body  necessarily 
backs  out  of  these  service  delivery 
fields  entirely.  It  may  carry  on  in  an 
inspection  or  audit  role,  or  undertake 
licencing  and  set  standards  of  operation. 
However,  the  public  body's  control  over 
records  transferred  to  or  created  in  a 
privatized  service  environment  would 
likely  be  quite  limited. 

A privatization  of  services  should  be 
governed  by  an  agreement  or  contract 
which,  in  turn,  should  deal  substantively 
with  the  issues  of  freedom  of 
information,  protection  of  privacy  and 
records  management.  A first  step  in 
considering  these  information  law  and 
management  issues  should  be  to 
carefully  review  what  records  it  is 
essential  to  transfer  in  order  to  get  a 
privatized  service  up  and  running.  If 
this  can  be  done  without  transferring 
records  containing  mandatory 
exceptions,  such  as  third  party 


confidential  business  information  or 
information  harmful  to  personal  privacy 
or  information  protected  under  statute, 
then  there  will  be  less  difficulty  in 
reaching  an  agreement  between  the  new 
service  provider  and  the  public  body. 
Another  option  may  be  to  copy  records 
needed  by  the  non-government  body,  if 
the  amount  and  complexity  of  the 
records  permit  such  an  approach. 

The  Provincial  Archives  of  Alberta 
should  be  consulted  when  a 
privatization  contract  affecting  records 
is  being  negotiated  and  may  be  involved 
to  establish  provisions  for  the 
preservation  of  archival  records.  Where 
records  have  permanent  archival  value, 
it  is  recommended  that  public  bodies 
retain  ownership  and  provide  them  to 
the  non-government  body  on  a long- 
term loan  basis. 

Components  of  Privatization 
Contracts 

A contract  that  governs  a privatization 
of  a service  should: 

• clearly  establish  those  very  limited 
types  of  records  or  functions  over 
which  the  public  body  will  maintain 
control  and  extinguish  control  over 
all  other  types  of  records  created  by 
the  privatized  service  in  the  future; 

• provide  for  a Records  Alienation 
Schedule  approved  by  the  Alberta 
Records  Management  Committee 
which  governs  the  transfer  of 
records  to  the  privatized  authority, 
and  which  may: 

- establish  retention  periods  for 
these  records; 
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- provide  that  no  disposal  of  these 
records  may  take  place  without 
the  written  approval  of  the 
public  body;  and 

- provide  that  disposition  of 
records  indicated  for  permanent 
retention  will  be  either  to  the 
Provincial  Archives  of  Alberta 
or  destruction; 

Note:  The  schedule  should  be 

authorized  by  the  Alberta 
Records  Management 
Committee  before  the 
contract  is  agreed  to. 

• indicate  the  nature  of  the  limited 
control  which  the  government  may 
retain  over  all  records  transferred  to 
the  privatized  service  and  the  basis 
of  ownership  and  control  of  future 
records  and  public  access  to 
information;  and 

• establish  any  special  privacy 
protection  measures  which  the 
privatized  service  must  take  to 
protect  personal  information  from 
unauthorized  access,  use,  disclosure 
or  data  matching  or  linkage  while  it 
remains  in  its  custody. 

It  should  be  noted  that  the  transfer  of 
responsibility  for  collecting,  managing, 
using  and  disclosing  personal 
information  from  a government  to  a 
privatized  service  can  cause  particular 
difficulties.  This  means  that  the 
personal  information  was  originally 
collected,  used  and  disclosed  under 
conditions  which  imposed  statutory 
requirements  on  the  public  body  to 
protect  the  privacy  of  the  individuals 
involved  with  the  service.  Any 
privatization  of  such  services  to  the 


private  sector  or  to  any  organization  not 
covered  by  the  FOIP  Act  or  similar 
legislation  at  the  federal  level  means 
that  these  protections  are  being  taken 
away.  This  may  lead  to  criticism  from 
those  individuals  and  the  public 
generally.  Whenever  possible,  public 
bodies  should  negotiate  a clause  in  the 
contract  where  the  new  service  provider 
undertakes  to  meet  the  privacy 
protection  measures  set  out  in  Part  2 of 
the  Act  or  comparable  measures  such  as 
the  Canadian  Standards  Association 
Model  Code  for  the  Protection  of 
Personal  Information  (CN/CSA-Q830- 
96), 


June  1997 


25 


i'-'.,.  J3  ...  . ,.  , 

^ ^ ^ ^ •t^v. 

if»i^O«i«!  .<k.|:-;*Vi.(^'^^  . 4^  ■■  _ ■ 

i-  I''fi-«^^«»S'%^»I1^  I 'F”  -^d 


%■'' 

'.‘-tyaAli* 

■’  ' "'  '■  ■'“  ■*  ‘’‘“  lAiSi^'i  0 %v,‘4i&'! 


■,  'gp  ■n’jma  „ It.dfc  ■ ■. ..: 


F'' 


■ *i  ',  ' 'f  rv^' Pw  i>:  n >’ 


;!i> 


<[ :.  'I 

/1’V 


l‘ . '’k- 


■' 


■.v»,,jv I ^' ' ' < ',,  -,  • jj^V 


f.',  „ v/  i .■n<r4;rufe.<tr4<dili 


' ,’Ai  I 


iU  fJJJ,'  >‘  W'i  O I 

i/i  {Jv^-w 

an/'tW^»lr>g|»«JT». 


i-^via;!  r,yi.MC,' B ,, 

J 

„ "''pI[ 


L.A' 


Appendix  A: 

FOIP  and  Records  Management  Checklist 
for  Contract  Managers 


Contracting  Guide  for  FOIP  and  Records  Management 


APPENDIX  A: 

FOIP  AND  RECORDS  MANAGEMENT  CHECKLIST 
FOR  CONTRACT  MANAGERS 


The  Planning  Stage 

□ How  does  this  contract  or  agreement  fit  into  the  business  objectives  and  activities  of 
the  program  involved?  Is  this  a project  requiring  extensive  operational  controls  over 
the  activities  of  the  contractor  or  less  rigorous  reporting  and  production  of  reports  along 
with  normal  financial  controls? 

□ Given  the  overall  objectives  of  the  contract  or  agreement,  what  records  will  be  created 
by  the  contractor? 

□ Which  of  those  records  does  the  public  body  consider  it  necessary  to  exercise  control 
over  for  operational  and  financial  purposes?  For  how  long? 

□ Is  it  feasible  for  those  records  to  remain  in  the  custody  of  the  contractor  after 
termination  of  the  contract  or  agreement  or  should  they  be  transferred  to  the  public 
body? 

□ Will  the  contractor  be  provided  with  personal  information  or  required  to  collect  or 
compile  such  information? 

□ Is  the  collection  and  use  of  personal  information  necessary  to  meet  the  business 
objectives  of  the  contract  or  agreement  or  are  there  other  ways  of  meeting  these 
objectives,  such  as  providing  non-identifiable  data? 

□ Does  the  public  body  have  the  authority  to  collect  and  use  the  personal  information  it  is 
slating  for  collection? 

The  RFP  or  Tendering  Stage 

□ Has  a clause  been  included  in  the  Request  for  Proposal  (RFP)  or  similar  documentation 
which  states  that  confidentiality  may  be  afforded  to  records  submitted  in  response  to  an 
RFP  or  request  for  tender  only  under  limited  circumstances  as  authorized  under  the 
Freedom  of  Information  and  Protection  of  Privacy  (FOIP)  Act? 

□ Has  reference  been  made  as  to  how  rating  and  evaluation  records  will  be  treated  under 
a FOIP  request? 

□ Has  reference  been  made  to  the  authority  to  collect  personal  information  as  part  of  the 
RFP  or  other  tendering  process? 
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□ Have  the  records  which  need  to  be  created  and  must  be  under  the  public  body's  control 
been  clearly  identified? 

□ Has  there  been  consultation  with  the  Senior  Records  Officer  (SRO)  about  required 
retention  periods  and  any  necessary  structure  for  the  records  and  are  these  requirements 
reflected  in  the  terms  and  conditions  of  the  RFP  or  similar  documentation? 

□ Does  the  RFP  or  similar  documentation  inform  potential  contractors  of  their 
responsibilities  with  respect  to  submitting  records  upon  request? 

□ Where  personal  information  is  involved,  have  potential  contractors  been  informed  that 
the  winning  bidder  will  be  accepting  the  same  responsibilities  for  protecting  the 
personal  privacy  of  individuals  as  required  of  the  public  body? 

□ Where  the  collection  and  handling  of  personal  information  forms  a major  part  of  an 
RFP  or  similar  documentation,  does  the  RFP  or  similar  documentation  either  set  out 
the  privacy  protection  requirements  which  a potential  contractor  must  live  up  to  or 
request  an  approach  from  potential  contractors  as  to  a plan  or  approach  through  which 
they  would  propose  to  meet  these  statutory  obligations? 

□ Have  potential  contractors  been  advised  that  certain  records  will  have  to  be  stored 
separately  from  other  records  to  allow  for  easier  access  by  the  public  body  and  to 
assure  the  proper  application  of  privacy  protection  requirements? 

Awarding  the  Contract 

□ Have  the  applicable  standard  clauses  been  employed  in  the  contract  or  appropriate 
alterations  made  to  them  in  order  to  set  out  a contractor’s  responsibilities  and 
obligations  for  freedom  of  information,  protection  of  privacy  and  records  management 
and  to  establish  the  nature  of  the  public  body's  control,  if  any,  over  the  records  and 
personal  information  involved  with  a project? 
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APPENDIX  B: 

SAMPLE  FOIP  AND  RECORDS  MANAGEMENT  CLAUSES 
FOR  CONTRACTS 

Note:  The  following  clauses  are  provided  as  samples  only.  They  may  only  be  required  in  a 
small  number  of  cases  where  minor  changes  to  the  simple  clauses  for  RTFs  provided  in  the 
body  of  this  guide  prove  insufficient.  Please  seek  legal  advice  on  any  clauses  to  be 
employed  in  particular  contracts.  Where  “Minister”  is  used,  it  may  be  appropriate  to 
replace  it  with  the  name  of  a corporate  public  body  which  is  not  headed  by  a “Minister.” 
The  word  “agreement”  or  a similar  term  can  be  substituted  for  the  word  “contract.” 


Section  1 : Records  Management 

a)  Records  Created  or  Maintained: 

Pursuant  to  this  contract,  the  contractor  will  create  or  obtain  the  following  types  of 
records  (listings  of  types  of  records). 

b)  Conditions  of  Management: 

Pursuant  to  this  contract,  the  contractor  will  maintain  all  referenced  records  in  a usable, 
organized  form  in  accordance  with  any  conditions  or  standards  established  by  the 
(name  of  public  body)  and  appended  to  this  contract. 

c)  Ownership  of  Records: 

The  contractor  acknowledges  that  all  (or  specific)  documents,  surveys,  plans,  reports, 
examinations,  analysis,  master  plates  for  a final  report,  and  any  and  all  other  materials 
whatsoever  related  to  the  services  provided  under  this  contract  are  the  property  of  the 
Minister  and  will  be  given  to  the  Minister  immediately  upon  request  or  at  the  termination 
of  the  contract,  whichever  occurs  first,  (or) 

All  technical  information,  inventions,  methods  and  processes  conceived  or  developed  or 
first  actually  reduced  to  practice  in  carrying  out  this  contract,  are  the  property  of  the 
Minister  and  must  be  fully  and  properly  disclosed  in  writing  to  the  Minister  by  the 
contractor.  The  contractor  may  not,  without  the  written  consent  of  the  Minister,  divulge 
or  use  such  technical  information,  inventions,  methods  or  processes  other  than  in 
carrying  out  the  project,  (or) 

Unless  otherwise  indicated  by  the  Minister  in  a notice,  the  copyright  to  all  material 
prepared  by  the  contractor  under  this  contract  belongs  to  the  Government  of  Alberta. 
Such  material  is  to  be  delivered  to  the  Minister  upon  completion  of  the  project  or  as 
otherwise  specified  in  this  contract. 
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d)  Definition  of  Record: 

In  this  contract,  record  means  a record  of  information  in  any  form,  including  books, 
documents,  maps,  drawings,  photographs,  letters,  vouchers  and  papers  and  any  other 
information  that  is  written,  photographed,  recorded  or  stored  in  any  manner,  but  does 
not  include  software  or  any  mechanism  that  produces  records. 

Note:  If  transitory  records  are  referenced  in  the  contract,  they  should  also  be  defined 
as  to  type  of  record  involved  (e.g.,  draft  or  duplicate  records). 

e)  Transfer  of  Records: 

Pursuant  to  this  contract,  the  following  types  of  records  (list  types  of  records)  have 
been  provided  to  the  contractor  and  will  be  maintained  in  the  same  organization  and 
under  the  same  conditions  as  they  have  been  maintained  by  the  (name  of  public  body). 

The  contractor  shall  keep  separate  from  all  its  other  records  and  databases  all  personal 
information  transferred  to  it  by  the  (name  of  public  body)  or  collected  or  compiled 
pursuant  to  this  contract. 


f)  Access  by  Public  Body: 

The  contractor  will  provide  the  (types  of  records)  to  the  (name  of  public  body)  in 
accordance  with  the  following  schedule,  (or) 

The  contractor  will  provide  to  the  (name  of  public  body),  at  the  contractor's  expense, 
any  and  all  records  required  to  be  created,  obtained  and  maintained  pursuant  to  this 
contract  within  (number)  calendar  days  of  notification  by  (name  of  position). 


g)  Records  Retention: 

All  records  created,  obtained  and  maintained  pursuant  to  this  contract  become  and 
remain  the  property  of  the  (name  of  public  body)  and  are  to  be  retained  by  the 
contractor  for  a period  of  (months  or  years)  following  the  completion  of  the  contract  and 
then: 

1 ) destroyed  in  accordance  with  government  standards  of  security  used  by  the 
Alberta  Records  Centre  or  returned  to  the  public  body  at  the  contractor's  expense; 
(or) 

2)  provided  to  (name  of  the  public  body)  at  the  conclusion  or  termination  of  the 
contract  at  the  contractor's  expense;  (or) 

3)  the  records  (generic  listing)  provided  by  the  (name  of  public  body)  to  the  contractor 
will  be  returned  to  the  (name  of  public  body)  at  the  conclusion  or  termination  of  the 
contract  at  the  contractor's  expense. 
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A transitory  record  as  defined  under  this  contract  does  not  need  to  be  maintained  and 
managed  by  the  contractor  and  its  destruction  is  authorized  by  the  (name  of  public 
body).  A transitory  record  is  (generic  description  of  types  of  records). 

Notwithstanding  the  above  specifications  or  retention  period  the  contractor  must, 
except  for  transitory  records,  notify  the  (name  of  position  in  public  body)  that  the 
records  are  about  to  be  destroyed  in  accordance  with  the  contract  and  receive  the 
(name  of  public  body's)  prior  written  approval  for  disposition  and  notify  the  (name  of 
public  body)  that  disposition  has  taken  place. 


Section  2:  Freedom  of  Information  and  Protection  of  Privacy 

a)  General  Clauses: 

The  contractor  acknowledges  that: 

1 ) the  Freedom  of  Information  and  Protection  of  Privacy  Act  applies  to  all  information 
and  records  relating  to,  or  obtained,  generated,  collected  or  provided  under  or 
pursuant  to  this  contract; 

2)  section  86  of  the  Act  specifies  that  a person  who  willfully  destroys  any  records 
which  are  subject  to  the  Acf  with  the  intent  to  evade  a request  for  access  to  records 
is  guilty  of  an  offence  and  is  liable  to  a fine  of  not  more  than  $10,000;  and 

3)  the  Minister  may  commence  legal  action  against  the  contractor,  its  employees  and 
agents  if  there  is  a breach  of  any  of  the  terms  or  conditions  of  the  contract. 

For  the  records  and  information,  possessed  or  obtained  by  the  contractor  in  connection 
with,  under,  or  pursuant  to  this  contract,  the  contractor  agrees  to  conduct  himself  to  a 
standard  consistent  with  the  Act  when  providing  the  services  or  carrying  out  the  duties 
or  other  obligations  of  the  contractor  under  this  contract. 

The  contractor  is  responsible  for  ensuring  complete  compliance  of  its  employees  and 
agents  with  all  terms  and  conditions  related  to  protection  of  privacy.  In  the  event  that 
the  contractor  becomes  aware  of  a breach  of  any  of  these  terms  or  conditions,  it  shall 
notify  the  (name  of  public  body)  immediately  in  writing. 

The  contractor  agrees  to  notify  each  employee,  officer  and  other  person  who  may  see 
or  obtain  access  to  the  personal  information; 

1)  of  the  legal  provisions,  duties  and  obligations  established  by  Part  2 of  the  Freedom 
of  Information  and  Protection  of  Privacy  Act  v^h\ch  are  stipulated  in  the  contract. 

2)  that  each  employee,  officer  and  other  person  who  may  see  or  have  access  to  the 
personal  information  is  also  obligated  to  comply  with  the  duties  and  is  subject  to  the 
liabilities  and  obligations  of  the  contractor  under  this  contract. 
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In  this  contract,  personal  information  has  the  same  meaning  as  in  section  1(1)(n)  of 
the  Freedom  of  Information  and  Protection  of  Privacy  Act  and  means  information  about 
an  identifiable  individual  in  any  form.  The  definition  in  section  1(1)(n)  of  the  yAcf  is 
provided  in  attachment  (name  attachment)  to  this  contract. 

Note:  Where  significant  amounts  of  personal  information  are  handled  by  the 
contractor,  or  particular  standards  are  required,  a description  of  the  standards  required 
of  the  contractor  should  be  attached  to  the  contract. 

b)  Collection: 

No  personal  information  may  be  collected  by  the  contractor,  its  employees  or  agents 
unless  the  collection  is  authorized  under  this  contract  (provide  authority  for  and 
purpose  of  the  collection)  or  the  collection  is  expressly  authorized  by  the  Minister  in 
writing  in  advance  of  any  collection  taking  place. 

The  contractor  must  collect  personal  information  directly  from  the  individual  the 
information  is  about  and  must  inform  the  individual  of; 

1 ) the  purpose  for  which  the  information  is  being  collected  as  stated  in  clause of 

this  contract;  and 

2)  the  specific  legal  authority  for  the  collection  as  stated  in  clause of  this 

contract  and  the  title,  business  address  and  business  telephone  number  of  an 
officer  or  employee  of  the  public  body  who  can  answer  the  individual’s  questions 
about  the  collection  as  provided  for  in  clause of  the  contract,  (or) 

3)  The  contractor  is  authorized  to  collect  personal  information  about  individuals  under 
the  authority  of  (stipulate  appropriate  paragraph  of  section  33(1)  of  the  Act). 

c)  Accuracy  and  Completeness: 

The  contractor,  its  employees  and  agents  will  make  every  reasonable  effort  to  ensure 
that  personal  information  that  is  or  is  to  be  used  to  make  a decision  that  directly  affects 
an  individual  is  both  complete  and  accurate. 

d)  Correction: 

The  contractor  acknowledges  that  individuals  or  their  representatives  have  the  right  to 
request  the  Minister  to  correct  personal  information  that  the  contractor,  its  employees 
and  agents  may  have  either  received  from  the  public  body  or  collected  or  compiled 
about  an  individual.  The  contractor  undertakes  to  make  any  corrections  or  annotation 
required  by  the  Minister  within  5 working  days  of  receiving  notice  and  direction  to  do  so 
by  the  (name  of  public  body). 
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e)  Protection  of  Personal  Information: 

The  contractor  must  protect  personal  information  in  its  custody  by  making  reasonable 
security  arrangements  against  such  risks  as  unauthorized  access,  collection,  use, 
disclosure  or  disposal  of  personal  information.  Specific  measures  include  (stipulate 
specific  measures  for  physical,  personnel  and  information  technology  security). 

Examples  of  such  stipulations  might  be: 

1)  Access  to  personal  information  in  a form  that  identifies  or  could  be  used  to  identify 
the  individual(s)  to  whom  it  relates  shall  be  limited  to  (specific  names,  if  possible,  of 
specific  employees  of  the  contractor). 

2)  The  contractor  shall  ensure  that,  prior  to  allowing  any  employee  to  have  or  have 
access  to  any  personal  information,  each  person  named  or  referred  to  above 
swears  an  oath  or  undertaking  of  confidentiality  with  respect  to  the  personal 
information  they  may  become  aware  of  in  the  performance  of  this  (contract  or 
agreement).  Oaths  are  to  be  maintained  on  file  by  the  contractor  for  the  duration  of 
the  contract  and  for  three  years  after  completion  of  the  contract  unless  otherwise 
specified  in  writing  by  the  (name  of  public  body). 

3)  Personal  information  will  only  be  kept  at  the  following  address  (specify).  Security 
will  be  maintained  through  the  following  physical  measures  (e.g.,  locked  cabinets, 
security  zones,  locked  rooms  and  controlled  access  to  the  premises)  and  the 
following  appropriate  information  technology  security  measures  (e.g.,  controlled 
computer  access,  authentication  of  systems  users,  and  communications  security). 

f)  Use: 


The  contractor  shall  not  either  directly  or  indirectly  use  personal  information  except  for 
the  following  purposes  (stipulate  purposes)  necessary  for  the  performance  of  the 
services  provided  by  the  contractor  under  this  contract.  Any  other  uses  for  any 
purpose  other  than  those  set  out  in  this  contract  must  be  expressly  authorized  by  the 
Minister  in  writing  in  advance  of  the  use.  At  the  termination  of  this  contract  the 
contractor,  its  employees  and  agents  shall  not  use  any  personal  information  obtained, 
collected  or  compiled  as  a result  of  this  contract  for  any  purpose. 

g)  Disclosure: 

The  contractor  shall  ensure  that  no  use  or  disclosure  may  be  made  of  the  personal 
information  obtained  by  or  provided  to  the  contractor  for  any  purpose  other  than  what 
is  needed  to  carry  out  this  contract  unless  the  contractor  has  received  the  prior 
express  written  authorization  for  doing  so  from  the  (name  of  public  body). 

h)  Data  Matching  and  Linkage: 

The  contractor  acknowledges  that  data  matching  and  linkage  forms  part  of  the 
services  which  will  be  undertaken  as  part  of  this  contract  and  that  data  matching  and 
linkage  will  be  undertaken  in  compliance  with  the  policy  direction  provided  in  the 
Freedom  Information  and  Protection  of  Privacy  Policy  Manuai,  which  is  attached 
to  this  contract  as  (identify  attachment). 
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Data  matching  is  the  comparison  of  personal  data  obtained  from  different  sources, 
including  both  electronic  and  paper-based  formats,  for  the  purpose  of  making 
decisions  about  whom  the  data  pertains  to. 

i)  Management  of  Personal  Information: 


The  contractor  shall  keep  separate  from  all  its  other  records  and  databases  all 
personal  information  transferred  to  it  by  the  (name  of  public  body)  or  collected  or 
compiled  pursuant  to  this  contract. 

All  personal  information  transferred  to  the  contractor  or  collected  or  compiled  by  the 
contractor  pursuant  to  this  contract  becomes  and  remains  under  the  control  of  the 
(name  of  public  body)  and  is  to  be: 

(either) 

1 ) retained  by  the  contractor  for  a period  of  (months/years  - the  minimum  retention 
period  for  personal  information  used  to  make  a decision  directly  affecting  an 
individual  is  one  year)  following  completion  of  the  contract  and  then  (destroyed  in 
accordance  with  government  standards  of  security  used  by  the  Alberta  Records 
Centre  or  returned  to  the  public  body)  at  the  contractor’s  expense; 

(or) 

2)  returned  to  the  (name  of  public  body)  at  the  conclusion  or  termination  of  the 
contract,  at  the  contractor's  expense. 

Personal  information  that  is  a transitory  record  under  the  definition  provided  in  this 
contract  does  not  need  to  be  maintained  and  managed  by  the  contractor  and  its 
destruction  is  authorized  by  the  (name  of  public  body).  Personal  information  that  is  a 
transitory  record  is  (generic  description  of  types  of  records). 

Notwithstanding  the  above  specifications  or  retention  periods,  the  contractor  must, 
except  for  personal  information  that  is  a transitory  record,  notify  the  (name  of  public 
body)  that  the  personal  information  is  about  to  be  destroyed  in  accordance  with  this 
contract,  receive  written  authorization  from  (name  of  position  in  public  body)  prior  to 
actually  destroying  the  personal  information,  and  confirm  with  (name  of  position  in 
public  body)  that  destruction  has  taken  place. 
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Section  3:  Indemnification  and  Responsibility  of  the  Contractor 

This  hold  harmless  will  survive  this  contract.  The  contractor  agrees  to  being  fully  and  solely 

responsible: 

1)  for  the  actions  of  each  of  its  employees,  agents,  consultants  and  other  persons  with  respect 
to  the  disclosure  and  use  of  information  whether  or  not  the  person  is  or  was  acting  within 
the  scope  of  his/her  employment,  agency,  consultancy  or  other  relationship  with  the 
contractor;  and 

2)  for  any  unauthorized  disclosure  or  use  of  information  which  is  disclosed  to  or  accessible  to 
the  contractor  pursuant  to  or  as  a result  of  carrying  out  this  contract,  regardless  of  the 
cause  (including,  but  not  limited  to,  negligence,  misfeasance,  malfeasance  or  accident  or 
neglect)  of  the  unauthorized  use  or  disclosure  during  the  term  of  this  contract  or  after  the 
expiration  of  earlier  termination  of  this  contract. 
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Appendix  C: 

Disclosure  of  Documents 
Used  in  Contracting 


Contracting  Guide  for  FOIP  and  Records  Management 


APPENDIX  C: 

DISCLOSURE  OF  DOCUMENTS  USED  IN  CONTRACTING  * 


Document 

Disclosure  Policy 

Potential  Exceptions 

Comments 

Routinely 

Available 

FOIP 

Request 

Required 

Requisition 

no 

yes 

s23  Advice  from  officials 
s24  Economic  interests  of  government  or 
public  body 

Definition  of  requisition  sometimes 
differs  among  public  bodies 

Tender  documents 

yes 

no 

none 

May  be  available  for  fee 

Invitation  to  Quote  (ITQ), 
tenders  or 

Request  for  Proposal  (RFP) 

yes 

no 

none 

Generally  public  documents 

Bidders  invited  for  ITQ  and  RFP 

yes 

no 

none 

Generally  available  to  public 

Bidders  meeting  minutes 

yes 

no 

none 

List  of  bidders  who  bid 

yes 

no 

List  of  bidders  available 

Bids,  proposals,  tenders 

no 

yes 

si 5 Third  party  business  interests 

si 6 Disclosure  harmful  to  personal  privacy 

Bottom  line  $ amounts  should  be 
released 

Unit  prices 

not  always 

yes,  when 
no  routine 
release 

s24  Economic  interests  of  government  or 
public  body 

si 5 Third  party  business  interests 

Withheld 

Evaluation  committee's  notes, 
memos  etc. 

no 

yes 

si 5 Third  party  business  interests 
si 6 Disclosure  harmful  to  personal  privacy 
si 8 Confidential  evaluations 
s23  Advice  from  officials 

Evaluation  of  each  bid,  proposal, 
tender 

no 

yes 

si 5 Third  party  business  interests 
si 6 Disclosure  harmful  to  personal  privacy 
si 8 Confidential  evaluations 
s23  Advice  from  officials 

Own  evaluation  generally  available 
to  each  bidder 

Summary  of  all  evaluations 

no 

yes 

si 5 Third  party  business  interests 
sl6  Disclosure  harmful  to  personal  privacy 
si 8 Confidential  evaluations 
s23  Advice  from  officials 
s24  Economic  interests  of  government  or 
public  body 

Negotiation  information 

no 

yes 

si 5 Third  party  business  interests 
si 6 Disclosure  harmful  to  personal  privacy 
sl.8  Confidential  evaluations 
s23  Advice  from  officials 
s24  Economic  interests  of  government  or 
public  body 

Recommendation  to  award 

no 

yes 

s23  Advice  from  officials 

Signed  contract  or  purchase  order 

no 

yes 

si 5 Third  party  business  interests 
si 6 Disclosure  harmful  to  personal  privacy 
s24  Economic  interests  of  government  or 
public  body 

Generally  disclosed  with  some 
severing 

Bidders'  correspondence  and 
responses 

no 

yes 

si 5 Third  party  business  interests 

si 6 Disclosure  harmful  to  personal  privacy 

Disclosed  with  severing 

* NOTE:  This  chart  is  a guide  showing  the  example  of  a typical  case.  As  for  all  FOIP  requests,  a review  of  the  particular 
records  requested  must  be  made. 
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